<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Sorry to declare success too quick, :( In fact, it is worse now, the IPA master fail after performing the above steps including the RUV cleaning. I've only one working replica and I'm afraid to do anything on it.</span></div><div><span><br></span></div><div><span>On The IPA master, after I ran 'service ipa restart' it reported OK, but 'ipa user-find' failed. so I cleared my Kerboers TGT ticket, ran 'kinit admin' to try my luck, the IPA master failed with the following message, it showed that 389 port listening disappeared for unknown reasons. </span></div><div><span><br></span></div><div><span><div>[root@ipamaster slapd-EXAMPLE-COM]# kinit admin</div><div><br></div><div>kinit: Generic error (see e-text) while getting initial credentials</div><div>[root@ipamaster slapd-EXAMPLE-COM]# netstat -antup
| grep -i LISTEN | grep ns</div><div>tcp 0 0 :::7389 :::* LISTEN 6550/ns-slapd </div><div>tcp 0 0 :::7390 :::* LISTEN 6550/ns-slapd </div><div>[root@ipamaster slapd-EXAMPLE-COM]# </div></span></div><div><span><br></span></div><div>The error logs are pasted here too.</div><div><br></div><div><div>[16/May/2012:14:41:43 -0700] set_krb5_creds - Could not get initial credentials for principal [ldap/ipamaster.example.com@EXAMPLE.COM] in keytab
[WRFILE:/etc/dirsrv/ds.keytab]: -1765328228 (Cannot contact any KDC for requested realm)</div><div>[16/May/2012:14:41:43 -0700] - slapd started. Listening on All Interfaces port 389 for LDAP requests</div><div>[16/May/2012:14:41:43 -0700] - Listening on All Interfaces port 636 for LDAPS requests</div><div>[16/May/2012:14:41:43 -0700] - Listening on /var/run/slapd-EXAMPLE-COM.socket for LDAPI requests</div><div>[16/May/2012:14:41:43 -0700] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_496' not found))</div><div>[16/May/2012:14:41:43 -0700] slapi_ldap_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: error -2 (Local error)</div><div>[16/May/2012:14:41:43 -0700] NSMMReplicationPlugin -
agmt="cn=meToipareplica01.example.com" (ipareplica01:389): Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_496' not found))</div><div>[16/May/2012:14:41:46 -0700] NSMMReplicationPlugin - agmt="cn=meToipareplica01.example.com" (ipareplica01:389): Replication bind with GSSAPI auth resumed</div></div><div><br></div><div>Thanks.</div><div><br></div><div>--David</div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> David Copperfield <cao2dan@yahoo.com><br> <b><span style="font-weight: bold;">To:</span></b> JR Aquino
<JR.Aquino@citrix.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, May 16, 2012 1:23 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] What to do next???: IPA replica host entry is removed on web UI by mistake<br> </font> </div> <br>
<div id="yiv247297194"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "><div><span>Hi JR,</span></div><div><span><br></span></div><div><span>Thanks a lot! It works perfectly.</span></div><div><span><br></span></div><div><span>The only extra thing probably goes with 2.1.3 only: I need to find and clear ghost RUV records for CA database, and remove it from master and all other live replicas as well. </span></div><div><span><br></span></div><div><span>BTW, on 2.2.0 the two database backends still are separate, or merged into one?</span></div><div><span><br></span></div><div><span>Thanks.</span></div><div><span><br></span></div><div><span>--David</span></div><div><br></div> <div style="font-size: 12pt; font-family: times, serif; "> <div style="font-size: 12pt; font-family: times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1">
<b><span style="font-weight:bold;">From:</span></b> JR Aquino <JR.Aquino@citrix.com><br> <b><span style="font-weight:bold;">To:</span></b> David Copperfield <cao2dan@yahoo.com> <br><b><span style="font-weight:bold;">Cc:</span></b> FreeIPAUsers <freeipa-users@redhat.com> <br> <b><span style="font-weight:bold;">Sent:</span></b> Wednesday, May 16, 2012 12:57 PM<br> <b><span style="font-weight:bold;">Subject:</span></b> Re: [Freeipa-users] What to do next???: IPA replica host entry is removed on web UI by mistake<br> </font> </div> <br>
On May 16, 2012, at 12:23 PM, David Copperfield wrote:<br><br>> Hi all,<br>> <br>> I accidentally removed one of my IPA replica host on IPA web UI by mistake, on the host list I planed to remove <a rel="nofollow" target="_blank" href="http://ipaclient02.example.com">ipaclient02.example.com</a>, but accidentally the mouse moved to <a rel="nofollow" target="_blank" href="http://ipareplica02.example.com">ipareplica02.example.com</a> and the latter got removed without a prompt.<br>> <br>> I realized the mistake and tried to recover from this disaster but it was already too late, the change propagated to all the replicas and the poor ipareplica02 now stops functioning.<br>> <br>> [root@ipareplica02 slapd-EXAMPLE-COM]# ipa service-find<br>> ipa: ERROR: cannot connect to u'<a rel="nofollow" target="_blank" href="https://ipareplica02.qe9.jigsaw.com/ipa/xml'">https://ipareplica02.qe9.jigsaw.com/ipa/xml'</a>: Internal Server
Error<br>> [root@ipareplica02 slapd-EXAMPLE-COM]#
ipa user-find<br>> ipa: ERROR: cannot connect to u'<a rel="nofollow" target="_blank" href="https://ipareplica02.qe9.jigsaw.com/ipa/xml'">https://ipareplica02.qe9.jigsaw.com/ipa/xml'</a>: Internal Server Error<br>> [root@ipareplica02 slapd-EXAMPLE-COM]# ipa host-find<br>> ipa: ERROR: cannot connect to u'<a rel="nofollow" target="_blank" href="https://ipareplica02.qe9.jigsaw.com/ipa/xml'">https://ipareplica02.qe9.jigsaw.com/ipa/xml'</a>: Internal Server Error<br>> [root@ipareplica02 slapd-EXAMPLE-COM]# <br>> <br>> On the IPA master, It was found that ipareplica02 didn't show up in 'host-find' list or 'service-find' list. Though it still showed in the master list reported by 'ipa-replica-manage' and 'ipa-csreplica-manage', the real command 'ipa-replica-manage list ipareplica02' fails with LDAP could't reach error.<br>> <br>> What should I do now? Is there are any other ways to recover besides uninstall and reinstall of IPA replica
ipareplica02?<br>>
<br>> BTW, it will be more than appreciated if the web UI could pop up a warning prompt when removing host/services entries associated with IPA masters and IPA replicas. <br><br>Been there... Done that... The bug is fixed in 2.2... It will prompt and prevent you from deleting a replica host if there is an agreement.<br><br>To clean up...<br><br>0. On the master replica: ipa-replica-manage del ipareplica02.example.com --force<br>-This will delete the replica agreement for the host.<br><br>1. $ ldapsearch -xLLL -D "cn=directory manager" -W -b dc=example,dc=com \<br> '(&(nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff)(objectclass=nstombstone))'<br><br>Look for your your nsds50ruv that matches your ghost replica.<br><br>2. Create an ldif following the directions here: http://directory.fedoraproject.org/wiki/Howto:CLEANRUV<br>Something like:<br><br>$ cat cleanup.ldif<br>dn: cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping
tree,cn=config<br>changetype: modify<br>replace: nsds5task<br>nsds5task: CLEANRUV## <- ## == The ReplicaID number for the ghost replica.<br><br>3. Run on all of the remaining replicas: ldapmodify -x -D "cn=directory manager" -W -f fixed.ldif<br>- This removes the ghost entry.<br><br>4. on the broken replica: ipa-server-install --uninstall<br><br>5. Follow the normal directions for 'installing a replica'<br>- on master: ipa-replica-prepare ipareplica02.example.com<br>- scp /path/to/ipareplica02.example.com.gpg ipareplica02.example.com: <a rel="nofollow" target="_blank" href="http://ipareplica02.example.com.gp">ipareplica02.example.com</a>.gpg<br>- on replica: ipa-replica-install ipareplica02.example.com --whatever_options_you_used_previously<br><br>6. Check to make sure the server was built correctly and command work as expected: kinit admin, ipa user-find, ipa host-find, id admin, etc etc<br><br>7. Sigh and drink coffee<br><br>>
Thanks.<br>>
<br>> --David<br>> From: Rich Megginson <<a rel="nofollow" ymailto="mailto:rmeggins@redhat.com" target="_blank" href="mailto:rmeggins@redhat.com">rmeggins@redhat.com</a>><br>> To: Ben Ho <<a rel="nofollow" ymailto="mailto:ben13ho@hotmail.com" target="_blank" href="mailto:ben13ho@hotmail.com">ben13ho@hotmail.com</a>> <br>> Cc: <a rel="nofollow" ymailto="mailto:freeipa-users@redhat.com" target="_blank" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> <br>> Sent: Tuesday, May 15, 2012 5:33 PM<br>> Subject: Re: [Freeipa-users] Help with ipa-replica-manage<br>> <br>> On 05/15/2012 02:49 PM, Ben Ho wrote:<br>>> This is the information I retrieved about my server.<br>>> <br>>> ipa-server-selinux-2.1.3-9.el6.x86_64<br>>> ipa-client-2.1.3-9.el6.x86_64<br>>> ipa-server-2.1.3-9.el6.x86_64<br>>> CentOS release 6.2<br>>> 389-ds-base-1.2.9.14-1.el6_2.2.x86_64<br>>>
<br>>> Thanks again.<br>> <br>> Is replication otherwise working?<br>>
<br>>> <br>>> -Ben<br>>> <br>>> Date: Tue, 15 May 2012 13:15:46 -0600<br>>> From: <a rel="nofollow" ymailto="mailto:rmeggins@redhat.com" target="_blank" href="mailto:rmeggins@redhat.com">rmeggins@redhat.com</a><br>>> To: <a rel="nofollow" ymailto="mailto:ben13ho@hotmail.com" target="_blank" href="mailto:ben13ho@hotmail.com">ben13ho@hotmail.com</a><br>>> CC: <a rel="nofollow" ymailto="mailto:freeipa-users@redhat.com" target="_blank" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>>> Subject: Re: [Freeipa-users] Help with ipa-replica-manage<br>>> <br>>> On 05/15/2012 01:00 PM, Ben Ho wrote:<br>>> Hello,<br>>> I am pretty new to IPA. Right now I have three servers that are running IPA. I am trying to replicate one server to two other servers. I use this command:<br>>> <br>>> ipa-replica-manage re-initialize --from
example2.edu<br>>> <br>>> On the first server I need to replicate, it works
fine. However, on the second server I get this message in my log files. The errors get printed out once every 1 to 5 minutes.<br>>> <br>>> [15/May/2012:14:22:43 -0400] NSMMReplicationPlugin - agmt="cn=meToexample1.edu" (example1:389): Schema replication update failed: Type or value exists<br>>> [15/May/2012:14:22:43 -0400] NSMMReplicationPlugin - agmt="cn=meToexample1.edu" (example1:389): Warning: unable to replicate schema: rc=1<br>>> [15/May/2012:14:22:47 -0400] NSMMReplicationPlugin - agmt="cn=meToexample2.edu" (example2:389): Schema replication update failed: Type or value exists<br>>> [15/May/2012:14:22:47 -0400] NSMMReplicationPlugin - agmt="cn=meToexample2.edu" (example2:389): Warning: unable to replicate schema: rc=1<br>>> <br>>> <br>>> Again, I am pretty new to this, so any help or tips would be appreciated.<br>>> <br>>> What platform and what version of 389-ds-base
and ipa-server for all of your servers?<br>>> <br>>> <br>>> Thanks!<br>>> <br>>> -Ben<br>>> <br>>> <br>>> <br>>> _______________________________________________<br>>> Freeipa-users mailing list<br>>> <br>>> <a rel="nofollow" ymailto="mailto:Freeipa-users@redhat.com" target="_blank" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>>> <a rel="nofollow" target="_blank" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>>> <br>> <br>> <br>> _______________________________________________<br>> Freeipa-users mailing list<br>> <a rel="nofollow" ymailto="mailto:Freeipa-users@redhat.com" target="_blank" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>> <a rel="nofollow" target="_blank"
href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>> <br>>
_______________________________________________<br>> Freeipa-users mailing list<br>> <a rel="nofollow" ymailto="mailto:Freeipa-users@redhat.com" target="_blank" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>> <a rel="nofollow" target="_blank" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br><br><br> </div> </div> </div></div></div><br>_______________________________________________<br>Freeipa-users mailing list<br><a ymailto="mailto:Freeipa-users@redhat.com" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br><br> </div> </div> </div></body></html>